Release date:
2026-10-16 07:12:34 UTC
Description:
- CVE-2026-9496: npm: avoid quadratic backtracking when pacote's addGitSha()
strips a committish from a git dependency spec, by replacing the `/#.*$/`
regular expression with an indexOf/slice strip; previously a rawSpec
carrying many '#' characters followed by a newline made the regex engine
restart its scan from every '#', costing seconds of CPU on a spec npm was
merely asked to resolve
Updated packages:
-
alt-nodejs18-nodejs-18.20.8-25.el7.x86_64.rpm
sha:012f23a9b92ee8cda1d6d602eae3791dff375bada3562a8d7d6897164f1ad469
-
alt-nodejs18-nodejs-devel-18.20.8-25.el7.x86_64.rpm
sha:b663b8dceb9a4e53fd2b8b2863f45877af8e899abfe17d8646e550fc656b38a9
-
alt-nodejs18-nodejs-docs-18.20.8-25.el7.noarch.rpm
sha:fd20ebf5df3ec97b99a3270ad8311331d0b8fa6a9ba8562c9fbcd28ea999a10c
-
alt-nodejs18-npm-10.8.2-18.20.8.25.el7.x86_64.rpm
sha:5c608b3a887f5319f8b76bf1fb8948133107a596fda60351db0b587f64d6a24c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
